gozi_ifsb | d5fe3f6846ca1f5e09e94d66a816c3fc00634013ca7bf9e35361bd185a27c395 | Triage

Sharing

General

Target

SecuriteInfo.com.Trojan.GenericKD.37639334.15084.27528
Size

345KB
Sample

210924-n7jrwaghdj
MD5

e7ac180e8217a97505fee5b06709d331
SHA1

85b078b46c648ec00de6e1952e4d165edbbc878e
SHA256

d5fe3f6846ca1f5e09e94d66a816c3fc00634013ca7bf9e35361bd185a27c395
SHA512

cbdab6a7e967cccb6b5cd2e611b479b367ee3b160936ec697a6c929f8ad47f767a7c427afea04e192421f1c064b00773cd53344981755bd56a6448280ac09fe5

Score

10^/10

gozi_ifsb 1500 banker trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1500

C2

apt.updateffboruse.com

app.updatebrouser.com

Attributes

build
250211
exe_type
loader
server_id
580

rsa_pubkey.plain

aes.plain

Targets

- Target
  
  SecuriteInfo.com.Trojan.GenericKD.37639334.15084.27528
- Size
  
  345KB
- MD5
  
  e7ac180e8217a97505fee5b06709d331
- SHA1
  
  85b078b46c648ec00de6e1952e4d165edbbc878e
- SHA256
  
  d5fe3f6846ca1f5e09e94d66a816c3fc00634013ca7bf9e35361bd185a27c395
- SHA512
  
  cbdab6a7e967cccb6b5cd2e611b479b367ee3b160936ec697a6c929f8ad47f767a7c427afea04e192421f1c064b00773cd53344981755bd56a6448280ac09fe5
Score

10^/10

gozi_ifsb 1500 banker trojan
- Gozi, Gozi IFSB
  Gozi ISFB is a well-known and widely distributed banking trojan.
  banker trojan gozi_ifsb
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

gozi_ifsb1500bankertrojan

behavioral2

gozi_ifsb1500bankertrojan